Setting the SameSite Attribute on the JSESSIONID cookie for Java based deployments

SameSite is a requirement in latest Chrome starting Feb 2020

Read a very good and easy-to-understand explainer on SameSite

Turns out none of  Java-based ecosystem : Servlet/Grails/Spring/Wicket/JBoss/Tomcat/WildFly etc are up to this simple and basic task that is easily handled by all other non-java frameworks like rails, django etc.  Bottomline is Servlet API has not implemented this spec and so not possible to do it either via code in Java based frameworks or config file changes in application server containers. So we have to resort to doing this from Apache server.

The following instructions are for apache2

• Enable the headers module and restart apache2:

sudo a2enmod headers

• Then modify your apache2 conf file to add the Header directive . You’ll have to edit  your conf file. I’ve seen online some people editing the httpd.conf and others add a headers.conf file etc.  It all depends on which flavour of Unix or Windows or MacOS you are running.  You’ll have to figure it out and make the change to wherever it is you usually make such changes to your website. I’m only giving the syntax to add Header directive here.

To set SameSite only on JSESSIONID cookie:

Header edit Set-Cookie ^(JSESSIONID.*)$ $1;HttpOnly;Secure;SameSite=<Strict|Lax|None>

Example:

Header edit Set-Cookie ^(JSESSIONID.*)$ $1;HttpOnly;Secure;SameSite=Strict

To set SameSite on ALL cookies :

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=<Strict|Lax|None>

Example:
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict

Apache has to be restarted after the change with :

service apache2 restart

You can then inspect your browser using Developer Console in Safari/Chrome and check the Cookies under Application -> Storage -> Cookies. Both browsers already have 3 new columns to show the values for HttpOnly, Secure and SameSite!